Extracted

• • Target

    ORDERN.F-1676.23.bat.exe

  • Size

    851KB

  • MD5

    358b29dc083fc85dad2d7fc5d37ac767

  • SHA1

    862f8241df559ae7607e5900dae86bee454bea9a

  • SHA256

    ea0d7f34cfddec8c57ddf23bfc5eab2c1692f1b3f5e8fdd6f4f7f8596e478d9d

  • SHA512

    ae9667504f70aef95dd9708ae8e2bbfc789cd0fff64bed6608433f48edfba193889e72decc0385d9875f16287e1feec4717c52a97510575ca1d0556410e1d0d5

  • SSDEEP

    12288:DrQzRa4+sxyjG9IzKjlauWV/dSw1nMks/jsexFacI5u0tnUoOiUQkxcwiKhtC:DmaSxjyOj9WVgMMO+ZIAdV

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2